Architect Data Action: 403 Forbidden on Lambda Invoke despite correct IAM Trust Policy

Architect & Flows
1

How do I fix the permissions for a Data Action calling a Lambda?

We’ve got a simple setup. The Architect flow hits a Data Action, which calls a Lambda endpoint. The Lambda returns a 403 Forbidden error. Here is the IAM Trust Policy attached to the Lambda role:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Service": "architect.niceincontact.com"
 },
 "Action": "lambda:InvokeFunction"
 }
 ]
}

The role also has the execution policy. The Lambda logs show the request is denied. We’ve tried adding the account ID, but it’s still failing. Is there a specific principal format required for CXone Architect?